Reference is made to FIG. 1, which is a simplified diagram of a prior art organization network 100 connected to an external internet 10. Network 100 is shown generally with resources including endpoint computers 110, databases 120, switches and routers 130, and mobile devices 140 such as smart phones and tablets, for ease of presentation, although it will be appreciated by those skilled in the art that organization networks today are generally much more complex and include other devices such as printers, other types of network elements such as relays, and any Internet of Things objects. The various connections shown in FIG. 1 may be direct or indirect, wired or wireless communications, or a combination of wired and wireless connections. Endpoint computers 110 and databases 120 may be physical elements or logical elements, or a mix of physical and logical elements. Endpoint computers 110 and databases 120 may be virtual machines. Endpoint computer 110 and databases 120 may be local, remote or cloud-based elements, or a mix of local, remote and cloud-based elements. Endpoint computers 110 may be client workstation computers, or server computers including inter alia file transfer protocol (FTP) servers, email servers, structured query language (SQL) servers, secure shell (SSH) servers and other application servers, or a mix of client and server computers. An organization's information technology (IT) department manages and controls network 100 in order to serve the organization's requirements and meet the organization's needs.
Access to endpoint computers 110 and databases 120 in network 100 may optionally be governed by an access governor 150, such as a directory service, that authorizes users to access endpoint computers 110 and databases 120 based on “credentials”. Access governor 150 may be a name directory, such as ACTIVE DIRECTORY® developed by Microsoft Corporation of Redmond, Wash., for WINDOWS® environments. Background information about ACTIVE DIRECTORY® is available at Wikipedia. Other access governors for WINDOWS and non-WINDOWS environments, include inter alia Lightweight Directory Access Protocol (LDAP), Remote Authentication Dial-In User Service (RADIUS), and Apple Filing Protocol (AFP), formerly APPLETALK®, developed by Apple Inc. of Cupertino, Calif. Background information about LDAP, RADIUS and AFP is available at Wikipedia.
Access governor 150 may be one or more local machine access controllers. Access governor 150 may be one or more authorization servers, such as a database server or an application server.
In lieu of access governor 150, the endpoints and/or servers of network 100 determine their local access rights.
Credentials for accessing endpoint computers 110 and databases 120 include inter alia server account credentials such as <address> <username> <password> for an FTP server, an SQL server, or an SSH server. Credentials for accessing endpoint computers 110 and databases 120 also include user login credentials <username> <password>, or <username> <ticket>, where “ticket” is an authentication ticket, such as a ticket for the Kerberos authentication protocol or NTLM hash used by Microsoft Corp., or login credentials via certificates or via another implementation used today or in the future. Background information about the Kerberos protocol and the LM hash is available at Wikipedia.
Access governor 150 may maintain a directory of endpoint computers 110, databases 120 and their users. Access governor 150 authorizes users and computers, assigns and enforces security policies, and installs and updates software. When a user logs into an endpoint computer 110, access governor 150 checks the submitted password, and determines if the user is an administrator (admin), a normal user (user) or other user type.
Endpoint computers 110 may run a local or remote security service, which is an operating system process that verifies users logging in to computers and other single sign-on systems and other credential storage systems.
Network 100 may include a security information and event management (SIEM) server 160, which provides real-time analysis of security alerts generated by network hardware and applications. Background information about SIEM is available at Wikipedia.
Network 100 may include a domain name system (DNS) server 170, or such other name service system, for translating domain names to IP addresses. Background information about DNS is available at Wikipedia.
Network 100 may include a firewall 180 located within a demilitarized zone (DMZ), which is a gateway between organization network 100 and external internet 10. Firewall 180 controls incoming and outgoing traffic for network 100. Background information about firewalls and DMZ is available at Wikipedia.
One of the most prominent threats that organizations face is a targeted attack; i.e., an individual or group of individuals that attacks the organization for a specific purpose, such as leaking data from the organization, modifying data and systems, and sabotaging data and systems.
Targeted attacks are carried out in multiple stages, typically including inter alia reconnaissance, penetration, lateral movement and payload. Lateral movement involves establishing a foothold within the organization and expanding that foothold to additional systems within the organization.
In order to carry out the lateral movement stage, an attacker, whether a human being who is operating tools within the organization's network, or a tool with “learning” capabilities, learns information about the environment it is operating in, such as network topology, organization structure, and implemented security solutions, and then operates in accordance with that data. One method to defend against such attacks is to plant misleading information/decoys/bait with the aim that the attacker learns of their existence and consumes those bait resources, which are monitored so as to notify an administrator of malicious activity. In order to monitor usage of deceptive information, trap servers, referred to as “honeypots”, are deployed in the organization. Background information about honeypots is available at Wikipedia.
With the influx of Generation Y and the increasing demand for flexible working, the shift from company owned devices to employees bringing their own devices is having a massive impact on how IT departments react to mobile security.
Although “bring your own device” is an attractive business model, there are a number of security risks associated with it. With data security being the number one concern for CEOs, ensuring that an IT environment is secure is more paramount than ever.
Use of employee smartphones within an organization has many security drawbacks.
Smartphones, as computers, are preferred targets of attacks. These attacks exploit weaknesses inherent in smartphones that arise from the communication modes including inter alia Short Message Service (SMS), also referred to as “text messaging”, Multimedia Messaging Service (MMS), Wi-Fi, Bluetooth and GSM. In additional there are exploits that target software vulnerabilities in the smartphone browser or operating system.
Smartphones generally have access to both the World Wide Web and the inner organizational network via the organization's Wi-Fi network. Often smartphones contain sensitive organization information, including inter alia organization mail, project notes, pictures and videos.
Unlike desktop computers and servers, smartphones are not always monitored by the IT department, because they belong to the employees (bring your own device) and not to the organization.
Monitoring smartphones via Mobile Device Management (MDM) includes installing security tools such as antivirus tools on the smartphones, but these security tools are not always effective for detecting advanced persistent threats (APTs).
At present, a deception solution for smartphones does not exist, and there is no reliable detection tool for APTs. As such, there is a need for a security solution to protect organizations against attackers that breach mobile phones belonging to employees of the organization that operate in conjunction with the organization's network.